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SUMMARY 


This  report  documents  the  work  performed  by  ARINC  Research  under  con¬ 
tract  to  the  Federal  Aviation  Administration  Technical  Center  to  perform 
a  technical  analysis  of  digital  systems  in  current-generation  aircraft, 
both  commercial  and  general  aviation.  The  purpose  of  this  study  was  to 
assist  the  FAA  in  its  efforts  to  assure  the  operational  safety  and  reli¬ 
ability  of  future  software-based,  integrated  digital  avionics  by  analyzing 
currently  available  data  on  digital  systems. 

Reliability  data  were  obtained  on  both  air  carrier  and  general  aviation 
digital  systems  within  the  following  categories:  navigation,  communications, 
flight  instruments,  flight  data,  and  autopilot  and  flight  controls.  The 
analyses  focused  on  identifying  the  relationships  between  performance  of  digital 
avionics  and  the  following  variables  of  interest:  failure  rate,  system  category, 
system  design,  and  system  application.  The  relationships  of  reliability  to 
existing  airworthiness  standards,  maintenance  programs,  integrity,  and  safety 
are  also  presented. 

The  data  presented  indicate  that  digital  systems  are  capable  of  per¬ 
forming  more  reliably  than  comparable  analog  systems.  The  data  suggest  that 
a  mean  time  between  removal  in  excess  of  2,000  hours  is  generally  achievable 
through  digital  design.  It  is  also  shown  that  the  number  of  removals  of 
digital  units  remains,  on  the  average,  twice  the  number  of  confirmed  fail¬ 
ures,  as  has  historically  been  the  case  for  analog  units. 

During  the  data  collection  process,  it  was  found  that  there  are  dif¬ 
ferences  in  reliability-reporting  formats  between  airlines  and  between 
avionics  manufacturers.  The  variations  generate  some  difficulty  in  develop¬ 
ing  a  composite  representation  of  the  reliability  of  digital  avionics.  In 
addition,  although  the  advent  of  digital  technology  has  enhanced  the  func¬ 
tional  capabilities  of  avionics,  the  user  community  expressed  some  concern 
regarding  aspects  of  the  implementation,  use,  and  maintenance  of  digital 
systems..  These  concerns  include  fault  propagation,  software  configuration 
control,  and  electrical  static  discharge. 

Data  bases  on  unit  reliability  that  include  information  on  the  cause 
of  failure  can  serve  as  indicators  of  where  emphasis  should  be  placed  to 
improve  unit  .lesion  and  mai ntenanee  procedures. 
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CHAPTER  ONE 


INTRODUCTION 


1 . 1  BACKGROUND 

Traditionally,  the  criteria  for  certification  of  flight  control  and 
avionics  systems  were  developed  on  the  premise  that  the  systems  were  non- 
integrated  and  analog.  These  older  systems  were  single- function,  discrete 
devices  that  were  amenable  to  relatively  simple  performance  measurement 
and  evaluation  tests.  With  the  advent  of  integrated-circuit  digital  tech¬ 
nology,  the  Federal  Aviation  Administration  (FAA)  was  presented  with  a  wide 
range  of  complex  new  safety  and  certification  issues. 

The  FAA  Technical  Center  is  supporting  the  development  of  techniques 
for  measuring  the  acceptability  of  digital  systems.  The  primacy  objectives 
of  the  Technical  Center  are  to  establish  research  activities  and  provide 
information  and  data  bases  related  to  the  performance,  reliability,  verifi¬ 
cation,  validation,  criticality  assessment,  and  configuration  management 
methodologies  for  existing  and  new  digital  systems. 

Any  recommendations  concerning  acceptance  criteria  for  digital  systems 
must  be  based  on  past,  present,  and  projected  problems  specifically  related 
to  digital  systems  and  their  integration  into  the  aircraft.  The  FAA  Tech¬ 
nical  Center  tasked  ARINC  Research  Corporation  to  acquire,  define,  and  ana¬ 
lyze  data  associated  with  digital  system  problems.  The  results  of  that 
activity  are  presented  in  this  report. 


1.2  PURPOSE 

The  purpose  of  the  project  was  to  assist  the  FAA  in  its  efforts  to 
assure  the  operational  safety  and  reliability  of  future  software-based, 
integrated  digital  avionics  by  analyzing  currently  available  data  on  digi¬ 
tal  systems.  Project  activities  were  concentrated  on  the  establishment  of 
a  data  base  of  past  and  current  performance  and  the  formulation  of  recom¬ 
mendations  for  continual  updating  with  data  on  new  and  emerging  components 
and  systems. 
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1.3  SCOPE 


The  project  encompassed  acquiring,  defining,  and  analyzing  data 
related  to  the  implementation,  use,  and  maintenance  of  digital  flight  con¬ 
trol  and  avionics  systems.  System  implementation  considerations  included 
those  minimum  performance  and  quality  control  standards  which  provide 
assurance  that  a  system  satisfactorily  performs  its  intended  functions. 
System  use  considerations  included  the  performance  and  reliability  of  the 
system  as  perceived  by  pilots,  maintenance  personnel,  purchasing  agents, 
and  manufacturers.  System  maintenance  considerations  included  the  tech¬ 
niques  used  for  fault  isolation  and  diagnosis  and  the  practices  employed 
to  maintain  optimal  system  performance. 

The  project  efforts  were  divided  generally  into  five  areas: 

•  Identification  of  systems  of  interest  (i.e. ,  systems  that  are  cur¬ 
rently  in  production  and  in  service) 

•  Acquisition  of  data  on  system  performability  (ability  to  maintain 
the  performance  of  intended  functions) 

•  Identification  of  units  that  are  in  production  but  are  not  cur¬ 
rently  in  use  (e.g.,  B-757  and  767  equipment),  and  units  that  are 
not  system-oriented  (e.g.,  low-cost  general  aviation  units) 

•  Analysis  of  data 

•  Recommendation  of  mechanisms  for  establishing,  maintaining,  and 
updating  the  data  base 

1.4  TECHNICAL  APPROACH 

Three  phases  of  effort  were  developed  for  this  project. 

1.  Determine  present  status  of  advanced,  integrated  digital  flight 
control  and  avionics  systems 

2.  Analyze  current  system  problem  areas 

3.  Reach  conclusions  concerning  methods  for  evaluating  existing  and 
new  systems 

During  Phase  1,  an  industry  search  was  conducted  to  identify  the  present 
status  of  digital  flight  control  and  avionics  systems.  The  information  of 
interest  included  the  quantities  of  digital  systems  currently  in  use  and 
the  function  and  application  of  each  system.  Sources  of  data  included  pre¬ 
viously  performed  market  surveys,  equipment  logs  of  major  users,  and  product 
murketma  information  from  technical  documents  and  brochures. 

The  Phase  2  analyses  required  in-depth  interviews  with  avionics  manu¬ 
facturers,  airline  operators,  and  ether  knowledgeable  experts.  Detailed 
iata  were  solicited  for  the  purpose  of  establishing  a  base  of  system  per¬ 
formance  and  reliability  data  applicable  to  system  implementation,  use, 


and  maintainability.  The  data  obtained  were  reviewed,  collated,  and  analyzed 
to  identify  critical  relationships  within  or  between  avionics  systems  that 
adversely  affect  operational  performance  and  reliability. 

The  results  of  Phases  1  and  2  were  used  in  Phase  3  to  develop  con¬ 
clusions  about  the  need  to  initiate  efforts  that  would  support  effective 
implementation,  use,  and  maintenance  of  digital  systems. 

1.5  REPORT  ORGANIZATION 

Chapter  One  has  provided  the  background,  purpose,  scope,  and  technical 
approach  of  the  study. 

Chapter  Two  presents  the  categories  of  digital  systems  which  were 
addressed  in  the  study  and  to  which  the  results  of  the  study  are  most 
applicable . 

Chapter  Three  provides  insight  into  the  reliability  of  avionics  and 
examines  the  relationship  between  reliability  and  safety. 

Chapter  Four  describes  existing  practices  for  reliability  reporting 
and  records  maintenance. 

Chapter  Five  presents  the  data  collected  and  describes  the  methods 
used  to  collect  and  organize  the  data. 

Chapter  Six  presents  analyses  of  the  data. 

Chapter  Seven  is  a  discussion  of  issues  pertinent  to  the  certification 
of  diqital  systems. 

Chapter  Eight  presents  conclusions. 

The  Appendix  is  a  glossary  of  terms. 


CHAPTER  TWO 


DIGITAL  SYSTEM  CATEGORIES 


2 . 1  CATEGORIES  INVESTIGATED 

The  systems  considered  pertinent  to  this  study  are  digital  flight 
control  and  avionics  systems,  including  navigation  and  sensor  systems. 

The  following  list  identifies  equipments  that  employ  some  degree  of  digital 
circuitry  and  were  therefore  investigated: 

•  Flight  Data  Systems 

••  Performance  data  systems 
••  Flight  data  recorders 

•  Autopilot  and  Flight  Controls 
• •  Autopilot 

••  Flight  controls 

•  Flight  Instruments  and  Navigation  Systems 

•  •  Flight  instruments 
••  Air  data  computers 
■ •  Compass  systems 

••  Stall  warning 
••  VOR/LOC/ILS 
• •  Marker  beacon 

•  •  ADF 

••  Weather  radar 

•  •  DME 

• •  ATC  transponder 
••  Radio  altimeter 
••  Thrust  rating 
••  Flight  director 


• •  Omega  navigation 
• •  Loran-C  navigation 
•  ■  VOR/DME  area  navigation 
• •  Ground  proximity  warning 

•  Communications  Systems 
• •  HF  communications 

• •  VHF  communications 

•  Electronic  Engine  Controls 

A  list  of  digital  systems  was  compiled  from  the  response  of  industry 
representatives  and  from  literature  searches,  including  in  the  list  seme 
analog  systems  for  comparison.  Data  were  collected,  compiled,  and  analyzed 
on  each  of  the  systems.  The  analyses  focused  on  identifying  the  relation¬ 
ships  between  unit  removal  rates  and  the  following  variables  of  interest: 

•  System  Category 

•  Failure  Rate 

•  Design 

• •  Analog 
••  Digital 

•  Application 

The  study  revealed  that  a  particular  avionics  unit  can  be  considered 
digital  by  some  and  analog  by  others.  Each  of  the  following  system  charac¬ 
teristics  was  offered  as  the  determining  factor  in  classifying  a  system  as 
digital : 

■  Digital  data  transfer  (e.g.,  modems) 

•  Digital  data  processing  (e.g.,  digital  DME) 

•  Microprocessor-based  design  with  user-accessible  memory  (e.g., 
flight  management  systems) 

It  is  difficult  to  rank  these  characteristics  according  to  design 
complexity,  since  it  cannot  be  assumed  that  a  unit  with  user-accessible 
memory  is  more  complex,  or  even  more  functionally  capable,  than  a  unit 
without  such  memory.  An  obvious  distinction  between  different  forms  of 
digital  system  implementation  is  the  level  of  dependence  on  software. 
Systems  that  are  software-based  can  be  modified  with  respect  to  runctional 
capability  without  accompanying  hardware  changes.  Software  changes  are 
general Lv  transparent  to  the  user  in  the  sense  that  he  cannot  know  that  a 
change  has  been  made  unLess  the  change  manifests  itself  in  a  dramatic  way. 
Subtle  changes  go  largely  unnoticed,  providing  little  opportunity  to  verify 
system  inteuritv.  The  introduction  >t  user-accessible  memory  increases  the 


potential  for  diminishing  system  integrity  through  memory  changes  that  might 
introduce  dif ficult-to-detect  errors. 

For  this  study,  a  unit  was  considered  digital  if  it  performed  some 
form  of  discrete  processing,  through  either  LSI  or  microprocessor  imple¬ 
mentation,  with  or  without  the  use  of  software. 


2.2  CATEGORIES  OF  APPLICATION 

The  digital  systems  listed  in  Section  2.1  were  evaluated,  in  the  light 
of  the  defined  variables  of  interest,  for  two  separate  categories  of  appli¬ 
cation:  air  carrier  and  general  aviation.  The  air  carrier  segment  of  the 
civil  fleet  is  limited  to  aircraft  operated  under  Federal  Air  Regulations 
(FAR)  Part  121*  and  Part  127.**  The  remaining  aircraft  in  the  civil  fleet 
are  considered  general  aviation,  including  the  air  taxi,  commuter,  and 
commercial  operators  regulated  by  FAR  Part  135+ .  The  following  sections 
identify  the  distinctions  between  the  air  carrier  and  general  aviation 
environments  with  respect  to  the  application  of  digital  avionics  and  flight 
control  systems. 

2.2.1  Air  Carrier  System  Usage 

The  U.S.  air  carrier  fleet  comprises  approximately  2,750  aircraft. 

The  major  aircraft  represented  in  the  fleet  are  the  B-727,  B-737,  B-747, 
DC-9,  DC-10,  and  L-1011.  These  aircraft  are  flown,  typically,  200  to  250 
hours  per  month,  with  the  time  varying  as  a  function  of  operator  and  air¬ 
craft  type.  With  yearly  operating  times  of  2,400  to  3,000  hours  per  air¬ 
craft,  it  is  important  to  the  carriers  to  have  sufficient  reliability  in 
their  avionics  to  minimize  the  need  for  frequent  maintenance  and  repair. 
Avionics  with  a  mean  time  between  failures  ( MTBF )  of  1,000  hours  would 
require  repair  three  times  a  year.  Further,  the  avionics  usually  are 
installed  at  the  time  of  airframe  manufacture  and  are  generally  replaced 
during  the  useful  life  of  the  aircraft.  This  long  period  of  anticipated 
maintenance  results  in  an  emphasis  by  air  carriers  on  avionics  designs 
that  reduce  maintenance  costs  rather  than  minimize  acquisition  cost. 

2.2.2  Use  of  General  Aviation  Systems 

The  general  aviation  fleet  has  about  210,000  active  airplanes,  ranging 
from  low-performance,  single-engine  aircraft  to  high-performance,  multi- 
engine  jets.  There  is  a  wide  diversity  of  aircraft  missions  and  pilot  pro¬ 
ficiencies  in  the  general  aviation  community.  However,  general  aviation 
aircraft  use  the  same  air  traffic  control  and  navigation  systems  as  the 
air  carrier  fleet.  The  avionics  in  the  general  aviation  aircraft  must  per- 


*"Certif ication  and  Operations:  Domestic,  Flag,  and  Supplemental  Air 
Carriers  and  Commercial  Operators  of  Large  Aircraft." 

** "Certi f ication  and  Operations  of  Scheduled  Air  Carriers  with  Helicopters." 
+"Air  Taxi  Operators  and  Commercial  Operators  of  Small  Aircraft." 
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form  the  same  functions  as  those  in  the  air  carrier  aircraft.  The  most 
significant  difference  between  the  air  carrier  and  general  aviation  air¬ 
craft  influencing  the  design  of  their  respective  avionics  is  the  typical 
annual  utilization  of  the  aircraft. 

The  utilization  of  general  aviation  aircraft  is,  on  the  average,  an 
order  of  magnitude  less  than  that  of  air  carrier  aircraft,  a  difference 
that  leads  to  both  economic  and  technical  differences  in  the  design  of  the 
avionics  for  the  two  segments  of  the  civil  fleet.  For  most  general  avia¬ 
tion  aircraft  an  MTBF  of  1,000  hours  would  limit  the  need  for  repair  to 
only  once  about  every  four  years. 


CHAPTER  THREE 


SIGNIFICANCE  OF  RELIABILITY 


3 . 1  OVERVIEW 

One  of  the  more  significant  differences  frequently  mentioned  in  com¬ 
parisons  between  analog  systems  and  digital  systems  is  the  greater  reli¬ 
ability  of  digital  systems.  For  this  reason,  it  is  appropriate  to  cite 
the  activity  of  RTCA  Special  Committee  130,  which  was  directed  in  1977  to 
do  the  following: 

a.  Investigate  the  various  means  of  determining  and  specifying 
reliability  for  electronic  systems  recommended  by  RTCA  Minimum 
Performance  Standards. 

b.  Assess  the  significance  of  specifying  MTBR  and  MBTF  for  safety 
of  flight  electrical  and  electronic  equipment.* 

Some  of  the  issues  considered  by  Special  Committee  130  were  investi¬ 
gated  in  this  study,  but  with  emphasis  on  the  unique  characteristics  of 
digital  systems.  In  addition,  any  discussion  of  reliability  invariably 
includes  references  to  maintainability,  integrity,  and  criticality  of 
failure.  It  is  difficult  to  separate  these  parameters  when  assessing 
their  relevance  to  safety.  Thus  the  following  sections  are  intended  to 
provide  a  general  understanding  of  the  concept  of  reliability  as  perceived 
by  the  air  carrier  and  general  aviation  communities.  The  relationships  of 
reliability  to  existing  airworthiness  standards,  maintenance  programs, 
integrity,  and  safety  are  also  presented. 


3.2  RELATIONSHIP  BETWEEN  RELIABILITY  AND  REGULATIONS 
3.2.1  Air  Carrier  Regulations 

FAR  Part  121  requires  that  certain  instruments  and  equipment  —  con¬ 
sidered  dispatch-critical  --  be  in  operable  condition  before  the  aircraft 
takes  off.  The  reliability  of  dispatch-critical  instruments  and  equipment 
is  therefore  crucial.  It  should  be  noted  that  in  the  context  of  FAR  Part 
121  reliability  is  associated  with  a  requirement  to  maintain  functional 


* Airborne  Electronics  and  Electrical  Equipment  Reliability ,  RTCA,  Document 
No.  DO-167,  September  1977. 


capability  rather  than  to  prevent  equipment  failure.  The  direct  dependence 
of  aircraft  dispatch  on  the  reliability  of  an  individual  unit  can  therefore 
be  reduced  through  equipment  redundancy.  Because  of  differences  in  the  air 
carriers'  approaches  to  maintaining  equipment  and  corresponding  service 
reliability,  varying  levels  of  importance  are  attached  to  such  reliability 
parameters  as  mean  time  between  removals  (MTBR)  and  mean  time  between  fail¬ 
ures  (MTBF) . 

The  airlines  of  the  United  States  pioneered  the  use  of  formal,  logic- 
based  decision  procedures  for  planning  scheduled  equipment  maintenance. 

Their  objective  was  to  structure  maintenance  programs  to  minimize  dispatch 
delays  in  a  cost-effective  manner.  FAA  Advisory  Circular  AC  121-22*  pro¬ 
vides  guidelines  to  be  used  in  the  development  and  approval  of  initial 
maintenance  and  inspection  requirements  for  air  transport  aircraft.  As 
stated  in  AC  121-22,  the  purpose  of  a  maintenance  program  is  to  maintain 
the  inherent  design  levels  of  operating  safety.  The  highest  level  of 
reliability  and  safety  that  can  be  expected  from  a  unit,  system,  or  air¬ 
craft  is  that  level  which  is  built  into  the  unit,  system,  or  aircraft  and 
therefore  inherent  in  the  design. 

AC  121-22  lists  the  following  objectives  of  an  efficient  airline  main¬ 
tenance  program: 

(a)  To  prevent  deterioration  of  the  inherent  design  levels  of  reli¬ 
ability  and  operating  safety  of  the  aircraft,  and  (b)  to  accom¬ 
plish  this  protection  at  the  minimum  practical  costs.* 

The  airlines  employ  different  techniques  and  procedures  in  establish¬ 
ing  and  complying  with  their  avionics  maintenance  programs.  The  details  of 
these  programs  and  the  records  associated  with  them  are  considered  proprie¬ 
tary  to  the  companies.  In  addition,  there  is  no  single  approach  to  reli¬ 
ability  and  maintainability  that  is  superior  to  all  others  for  all  circum¬ 
stances.  The  size  of  the  aircraft  fleet,  the  aircraft  model,  and  the  type 
and  frequency  of  operations,  as  well  as  other  considerations,  all  influence 
the  structuring  of  the  most  appropriate  maintenance  program  for  a  particular 
operator.  There  are,  however,  a  number  of  maintenance  practices  that  are 
common  to  most  air  carrier  operations. 

Historically,  airline  maintenance  programs  have  included  provisions 
for  preventive  maintenance.  The  tasks  associated  with  preventive  mainte¬ 
nance  may  include  the  following: 

•  Servicing 

•  Inspection 

•  Testing 

•  -  '.i !  ibration 

•  I  .icoment 


♦"Maintenance  Review  Board  (MRB),"  if  January  IJ7"7. 


The  scheduling  of  these  tasks  is  typically  based  on  one  of  three 
philosophies : 

•  Hard  Time  Limit 

•  On  Condition 

•  Condition  Monitoring 

A  hard  time  limit  establishes  specific  intervals  within  which  main¬ 
tenance  tasks  must  be  accomplished.  These  intervals  apply  to  overhauls 
as  well  as  replacement. 

Qn-condition  maintenance  requires  that  a  unit  be  periodically  inspected 
or  tested  against  some  standard  to  verify  that  it  can  remain  in  service. 

Condition  monitoring  is  a  process  applied  to  equipment  that  is  not 
subjected  to  a  hard  time  limit  or  on-condition  maintenance.  Condition 
monitoring  implies  an  environment  in  which  the  equipment  "flies  to  failure," 
also  referred  to  as  "removal  monitoring." 

It  is  possible  to  develop  additional  maintenance  tasks  in  a  scheduled 
maintenance  program  that  could  improve  reliability  but  would  not  be  con¬ 
sidered  cost-effective  —  as  in  situations  in  which  operating  safety  is  not 
affected  by  the  failure  condition  being  evaluated.  The  cost  of  the  proposed 
maintenance  task  might  exceed  the  value  of  the  expected  benefit,  and  it 
might  be  more  appropriate  to  apply  limited  available  resources  to  other 
areas  that  would  provide  a  greater  return  on  investment.  In  addition,  it 
has  been  determined  that  "overall  measures  of  reliability  of  complex  com¬ 
ponents,  such  as  the  premature  removal  rate,  usually  are  not  functions  of 
the  age  of  these  components."*  The  concept  of  predictable  degradation  of 
system  components  simply  does  not  apply  to  the  majority  of  current  and 
future  systems.  In  this  environment,  then,  scheduled  overhaul  will  not 
improve  operating  reliability. 

3.2.2  General  Aviation  Regulations 


The  performance  standards  and  specifications  to  which  air  carrier 
avionics  must  be  certificated  for  FAR  Part  121  operations  are  exemplified 
by  Technical  Standard  Orders  (TSOs) .  Demonstration  of  compliance  with  the 
TSO,  or  equivalent  conformity,  is  mandatory  for  air  carrier  operations. 
Compliance  with  TSOs  is  not  generally  required  for  general  aviation  opera¬ 
tions.  The  airworthiness  of  field  installations  of  avionics  is  commonly 
approved  by  means  of  a  simple  Form  337  weight  and  balance  report.  Some 
of  the  more  complex  installations,  particularly  those  including  automatic 
flight  controls,  require  Supplementary  Type  Certirication  (STC) . 

Requirements  for  maintaining  records  on  the  operation  of  ueneral  avia- 
f  n’n  air.  raft  are  minimal.  Avionics  maintenance  ind  repair  work  is  usually 
r  oi;ni\i  without  mnotation  of  1  on  time.  The  ref  ire,  •  ,»1  loot  ion  >f  repre¬ 
sentative  MTRF  data  on  ioner.il  aviation  iv  ionics  aas  not  been  :  tactical . 


* : 
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3.3  RELATIONSHIP  BETWEEN  RELIABILITY  AND  INTEGRITY 


The  integrity  of  a  system  is  a  measure  of  its  ability  to  detect  incor¬ 
rect  operation  or  failure.  The  objective  is  to  assure  that  the  system  will 
not  be  used  when  it  is  not  operating  within  its  specified  performance  limits 
Redundancy  is  one  means  of  improving  integrity.  Redundancy  can  be  provided 
at  either  the  system  or  the  subsystem  level,  with  either  identical  or  dis¬ 
similar  system  architecture,  and  in  independent  or  interdependent  modes  of 
operations.  Examples  of  interdependency  include  voting  and  averaging  tech¬ 
niques.  Self-test  features  incorporated  in  the  system  design  also  improve 
system  integrity. 

Most  means  of  improving  system  integrity  require  an  increase  ic  the 
parts  count  associated  with  the  functional  capability  being  provided.  As 
the  parts  count  increases,  so  does  the  opportunity  for  part  failure. 
Therefore,  equipment  reliability  can  diminish  as  a  consequence  of  improv¬ 
ing  integrity.  However,  functional  reliability  —  the  duration  of  uninter¬ 
rupted  satisfactory  functional  performance  —  can  be  increased  by  redundancy 

The  differences  between  equipment  reliability  and  functional  reli¬ 
ability  are  quite  significant,  but  these  differences  are  too  frequently 
ignored  when  safety  is  being  assessed  on  the  basis  of  reliability. 


3.4  RELATIONSHIP  BETWEEN  RELIABILITY  AND  SAFETY 

The  following  excerpt  from  RTCA  Document  DO-167*  is  considered  a 
satisfactory  interpretation  of  operating  safety  in  relation  to  system  • 
reliability: 

During  the  design  process  considerable  attention  is  given  to 
system  and  component  failure  effect  analysis  to  ensure  that 
failures  that  result  in  loss  of  function  do  not  immediately 
jeopardize  operating  safety.  In  many  cases,  redundancy  can 
cause  the  consequences  of  a  first  failure  to  be  benign.  In 
other  cases,  protective  devices  serve  this  purpose.  Although 
it  may  not  be  possible  to  continue  to  dispatch  the  airplane 
without  correcting  the  failure  and  although  it  may  indeed  be 
desirable  to  make  an  unscheduled  landing  after  failure,  the 
failure  cannot  be  considered  to  have  an  immediate  adverse 
effect  upon  operating  safety.  The  inclusion  of  the  word 
direct  in  the  phrase  'direct  adverse  effect  upon  operating 
safety'  means  an  effect  which  results  from  a  specific  failure 
mode  occurring  by  itself  and  not  in  combination  with  other 
possible  failure  modes. 

The  certification  process  is  intended  to  ensure  that  a  transport 
category  aircraft  has  very  few  failure  modes  which  have  a  direct  adverse 
effect  upon  operating  safety. 


*Airborr.e  Electronics  end  Electrical  Equipment  Reliability , 


September  1977. 


CHAPTER  FOUR 


RELIABILITY  RECORD  KEEPING 


4.1  AIR  CARRIER  RELIABILITY  RECORDS 

One  of  the  objectives  of  efficient  airline  maintenance  as  defined  in 
AC  121-22  is  to  "prevent  deterioration  of  the  inherent  design  levels  of 
reliability."  It  is  generally  expected  that  system  reliability  will  im¬ 
prove  with  time  as  the  system  matures.  Trend  analysis  is  an  effective 
means  of  monitoring  reliability  so  that  a  worsening  condition  cam  be  eas¬ 
ily  and  quickly  identified. 

Equipment  users  maintain  records  on  the  reliability  of  each  equipment 
type.  These  records  can  include  reference  to  a  variety  of  actions  that  are 
related  to  reliability: 

•  Pilot  reports 

•  Unit  removals 

•  Unit  failures 

•  Service  information  letters 

•  Service  bulletins 

The  issuance  of  a  pilot  report  does  not  necessarily  lead  to  a  removal. 

A  corrective  maintenance  action  such  as  reseating  the  unit  may  be  suffi¬ 
cient  to  eliminate  the  problem  indicated  in  the  pilot  report.  Further, 
equipment  removal,  as  reflected  in  MTBR ,  does  not  constitute  failure.  The 
reported  failure  of  a  removed  unit  is  frequently  unconfirmed,  and  this 
accounts  for  the  disparity  between  MTBR  and  MTBF .  Historical  data  indicate 
that,  on  the  average,  the  number  of  removals  is  about  twice  the  number  of 
confirmed  failures.  There  is  disagreement  about  how  to  interpret  a  fail¬ 
ure  verification:  Is  it  a  verification  of  the  failure  that  caused  the  prob¬ 
lem  reported  by  the  pilot,  or  is  it  the  identification  of  any  failure?  In 
addition,  there  are  some  questions  concerning  what  constitutes  a  failure. 

The  need  to  repLace  a  component  that  is  critical  to  the  satisfactory  per¬ 
formance  of  the  unit  definitely  indicates  the  occurrence  of  a  failure. 

But  should  an  out-of-tolerance  condition  that  causes  degradation  of  per¬ 
formance,  but  can  be  corrected  throuqh  a  simple  action  such  as  turning  an 
adjustment  screw,  bo  considered  a  fulure?  There  are  no  standard  answers 
to  these  questions.  Each  airline  develops  policies  that,  on  the  basis  of 
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past  experience  and  projected  trends,  it  considers  appropriate  for  assuring 
the  efficiency  and  effectiveness  of  its  operations. 

The  removal  of  a  unit  can  be  either  scheduled  or  unscheduled.  Sched¬ 
uled  removals  are  those  accomplished  to  comply  with  a  preventive  mainte¬ 
nance  program.  Removals  resulting  from  pilot  reports,  often  referred  to 
as  premature  removals,  are  unscheduled.  MTBR  can  include  the  mean  time 
between  unscheduled  removals  (MTBUR) .  It  is  therefore  difficult  to  com¬ 
pare  MTBRs  of  different  airlines  without  taking  into  account  the  differ¬ 
ences  in  their  maintenance  practices.  In  this  report,  MTBR  is  considered 
equivalent  to  MTBUR,  as  it  is  by  many  air  carriers. 

Records  are  kept  on  all  maintenance  actions  performed  on  a  unit.  The 
airlines  closely  monitor  units  that  require  maintenance  more  frequently 
than  called  for  by  a  specified  "alert  level."  The  alert  level  used  by  an 
individual  airline  is  based  on  both  historical  data  and  predictions  related 
to  the  most  effective  and  economic  means  of  avoiding  reliability  deteriora¬ 
tion.  Once  a  unit's  maintenance  exceeds  the  alert  level,  the  unit  is  en¬ 
tered  into  the  formal  monitoring  process  and  is  reported  on  each  month. 

As  a  result  of  the  increased  visibility  of  the  unit,  emphasis  is  placed 
on  identifying  and  correcting  the  problem  that  caused  the  alert  level  to 
be  exceeded.  There  are  a  variety  of  explanations  for  why  a  unit  is  experi¬ 
encing  excessive  removals,  including  improper  diagnosis  of  a  failure  condi¬ 
tion,  intermittent  failures,  or  a  component  failure. 

» 

Excessive  removals  that  are  due  to  improper  diagnosis  of  failure  con¬ 
ditions  can  be  remedied  through  education  and  training.  The  cause  of  inter¬ 
mittent  failures  can  be  elusive,  but  it  will  eventually  be  discovered 
through  application  of  a  structured  monitoring  and  diagnostic  program.  Com¬ 
ponent  failures  are  relatively  easy  to  trace  and  can  be  reported  to  the 
manufacturer.  Following  a  preliminary  investigation,  the  manufacturer  may 
send  a  service  information  letter  to  all  users  of  the  unit  in  which  a  prob¬ 
lem  has  been  identified.  The  letter  will  describe  the  symptoms  of  the 
problem  and  provide  some  assurance  that  the  problem  will  be  solved.  The 
manufacturer  will  issue  a  service  bulletin  to  all  users  when  a  solution  to 
the  problem  has  been  developed. 

Removal  rates  and  failure  rates  are  based  on  1,000  unit  operating 
hours.  The  MTBR  (or  MTBF)  is  calculated  by  dividing  the  total  unit  oper¬ 
ating  hours  accrued  in  a  particular  time  period  by  the  number  of  unit 
removals  (or  failures)  that  occurred  during  that  same  period.  Unfortun¬ 
ately,  there  is  no  consensus  on  the  appropriate  basis  for  computing  equip¬ 
ment  operating  hours.  Among  the  alternatives  are  the  use  of  gate-to-gate 
time,  time  from  wheels-off  to  wheels-on,  or  engine  operating  hours,  and  the 
if  ;  LicatLon  of  a  multif  lying  factor  to  some  form  of  log  time  (e.g.,  wheels- 
’■  to  wheo  la-on )  to  obtain  an  estimate  of  equipment  "on"  time.  The  actual 
mean;  t  omj  m  isiu  ■  ■  ,;u  1  j  -men  :  •  ■peratnw  houi  •>  is  frequently  negotiated  by 
'  !■.  •  at! ; ;  mu  ait  utd  matin'  io'  ,L'>r  to  .otalil  ;  j!i  the  basis  for  war- 

:  Hit"  iai  a*  •men  t  . 


Many  of  the  air  carriers  participate  in  the  exchange  of  reliability 
data  by  submitting  data  on  particular  systems  for  publication  in  PLANE 
TALK,  the  airline  industry  publication  on  avionics  maintenance.  Unfortu¬ 
nately,  many  of  the  data  inputs  are  not  directly  comparable,  since  differ¬ 
ent  airlines  use  different  methods  for  computing  and  reporting  system 
reliability.  These  differences  must  be  taken  into  account  if  valid  compar¬ 
isons  are  to  be  made. 

Although  the  failure  records  maintained  by  the  air  carriers  do  not 
follow  a  common  format,  the  following  parameters  are  considered  typical: 

•  Airline  part  number  (unique  to  each  airline) 

•  Description  of  part  (LRU,  e.g.,  VHF  NAV  RECEIVER) 

•  Fleet  code  (e.g.,  747) 

•  Quantity  per  aircraft  (e.g.,  2) 

•  Removal  rates  (parts  1,000  unit  hours) 

••  Current  count  (size  of  sample,  e.g.,  11) 

••  Current  month  actual  (e.g.,  0.931) 

••  Current  month  trend  (e.g.,  0.762) 

••  Current  control  limit  (e.g.,  1.269) 

••  Last  12  months  (e.g.,  0.514) 

•  MTBR  -  last  12  months  (e.g.,  1967) 

•  Failure  rates  (parts/1,000  unit  hours) 

••  Current  count  (e.g.,  4) 

••  Current  month  actual  (e.g.,  0.339) 

••  Current  month  trend  (e.g.,  0.372) 

••  Last  12  months  (e.g.  0.304) 

•  MTBF  -  last  12  months  (e.g.,  3262) 

•  Failure  rate/removal  rate  -  last  12  months  (e.g.,  0.591) 

The  Avionics  Maintenance  Conference  (AMC) ,  a  coalition  of  representa¬ 
tives  of  air  transport  operators,  equipment  manufacturers,  airframe  manu¬ 
facturers,  and  regulatory  and  support  organizations,  provides  an  open  forum 
to  discuss  avionics  maintenance  problems.  One  of  the  AMC  task  groups  is 
developing  an  upgraded  reliability  reporting  program.  As  it  does  now, 

PLANE  TALK  will  provide  the  means  of  disseminating  reliability  data  through¬ 
out  the  industry.  The  proposed  program  will  define  an  initial  baseline  of 
participating  operators  and  the  equipment  on  which  each  participating 
operator  will  provide  data.  A  standard  format  will  be  used  for  data  sub¬ 
mission,  and  it  wiLl  require  both  MTBUR  and  MTBF.  The  proposed  schedule 
tor  implementing  tins  upgraded  reporting  proqram  lists  31  August  1982  as 
'  lie  date  on  which  proposed  data  forms  will  be  submitted  to  operators  tor 
their  review.  The  first  report  under  the  new  program  is  scheduled  for 
publication  in  PLANE  TALK  in  January  1983. 
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4.2  GENERAL  AVIATION  RELIABILITY  RECORDS 


A  review  of  the  entire  spectrum  of  general  aviation  operators  reveals 
a  lack  of  records  that  would  permit  a  comprehensive  evaluation  of  avionics 
reliability.  There  are,  however,  particular  groups  within  the  general 
aviation  community  that  maintain  detailed  records.  Most  operators  of  cor¬ 
porate  fleets  of  heavy  aircraft  have  an  aviation  department  that  documents 
maintenance  and  cost  details.  Commuter  operators  also  maintain  detailed 
records,  whether  they  run  their  own  avionics  maintenance  shop  or  employ 
an  independent  certificated  repair  agency.  However,  the  avionics  reli¬ 
ability  studies  performed  on  the  basis  of  these  available  records  have 
been  structured  primarily  for  specific  product  evaluations. 

The  element  of  the  industry  most  highly  motivated  to  collect  avionics 
reliability  data  is  the  avionics  manufacturer.  Whether  the  market  is  air 
carrier  or  general  aviation,  MTBF  is  a  powerful  selling  tool,  with  signif¬ 
icance  to  both  the  avionics  user  and  the  manufacturer.  If  for  any  reason 
an  avionics  manufacturer  introduces  a  product  that  is  perceived  as  unreli¬ 
able  by  potential  customers,  he  is  faced  with  a  reduction  in  sales  revenue 
and  an  increase  in  warranty  or  remanufacturing  expense.  Thus,  to  avoid 
these  economic  problems,  in-  the  past  decade  manufacturers  have  used  a 
number  of  data  collection  and  data  processing  techniques  to  measure  the 
reliability  of  products  when  they  are  introduced. 

Product  reliability  can  be  Setermined  in  several  ways: 

•  The  theoretical  MTBF  can  be  calculated  from  the  parts  count  and 
the  other  data  recorded  during  the  design  process. 

•  A  demonstrated  MTBF  can  be  produced  by  subjecting  a  limited  prepro¬ 
duction  batch  of  the  product  to  a  complex  series  of  stress  tests. 

•  The  warranty  claims  submitted  during  the  warranty  period,  typically 
the  first  year  of  installation  and  service,  can  be  used  in  conjunc¬ 
tion  with  the  operator-reported  utilization  of  the  aircraft  to 
establish  a  reasonably  credible  MTBF. 


CHAPTER  FIVE 


DATA  COLLECTION 


5.1  DATA  COLLECTION  METHOD 

One  of  the  primary  objectives  of  the  study  was  to  identify  how  widely 
digital  avionics  and  flight  control  systems  are  used  in  currently  opera¬ 
tional  aircraft.  Careful  selection  of  appropriate  air  carriers  provided 
a  well  distributed  sampling  of  all  relevant  air  transport  aircraft. 

The  May  1981  publication  of  Air  Transport  World  presented  a  breakdown 
of  the  world  air  transport  fleet  based  on  1980  data.  Close  examination  of 
the  fleet  data  indicated  a  dominance  of  the  six  aircraft  types  listed  in 
Table  5-1.  Since  they  constituted  77.7  percent  of  the  fleet  identified  in 
Air  Transport  world,  it  was  concluded  that  an  investigation  of  the  types 
and  quantities  of  digital  avionics  used  in  those  aircraft  would  provide  a 
reasonable  indication  of  total  fleet  utilization  of  digital  systems.  The 
aircraft  listed  in  Table  5-1  are  manufactured  in  the  United  States.  It  is 
recognized  that  other  countries  manufacture  large  numbers  of  aircraft. 
However,  foreign-manufactured  aircraft  represent  only  a  small  fraction  of 
the  total  United  States  fleet,  and  any  digital  system  installations  are 
most  likely  duplicated  '-n  the  six  aircraft  selected. 


5~1 

COMPOSITION  OF 

AIRCRAFT  FLEET 

AIR  TRANSPORT 

Aircraft 

Type 

Number  in 

Fleet 

Percentage  of 
Fleet 

B-747 

449 

9.  2 

B-737 

5G8 

11.6 

B-727 

1 , 46  5 

30.0 

DC-  10 

312 

6 . 4 

DC- 9 

82b 

16. 9 

L-L011 

178 

3 . 6 

Total 

3  ,  ~n8 

7  7 . 7 

>-  L 


Having  identified  the  air  transport  aircraft  models  of  interest,  the 
distribution  of  those  models  among  selected  air  carriers  was  examined. 
Table  5-2  shows  that  distribution.  The  objective  of  this  exercise  was  to 
select  a  group  of  airlines  whose  cumulative  fleet  totals  of  a  particular 
aircraft  model  represented  at  least  15  percent  of  the  total  number  of  that 
model  in  use  throughout  the  world.  With  the  exception  of  the  DC-9,  that 
objective  was  satisfied  by  the  airlines  listed  in  the  table. 


Table 

5-2.  COMPOSITION  OF  AIR  CARRIER  FLEETS 

Airline 

Aircraft  Quantities 

B-747 

B-737 

B-727 

DC- 10 

DC- 9 

L-1011 

American 

14 

— 

179 

34 

— 

— 

Piedmont 

— 

42 

8 

— 

— 

— 

Eastern 

— 

— 

142 

— 

75 

29 

United 

18 

48 

173 

42 

— 

— 

Delta 

— 

— 

126 

— 

38 

35 

TWA 

18 

— 

90 

— 

— 

32 

Northwest 

29 

— 

66 

22 

— 

— 

Subtotal 

.  79 

90 

784 

98 

113 

96 

World  Fleet 

Total 

449 

568 

1,465 

312 

826 

178 

Percentage 
of  Fleet 

17.6 

15.8 

53.5 

31.4 

13.7 

53.9 

From  the  equipment  lists  provided  by  the  airlines,  a  composite  listing 
was  prepared  and  the  equipments  subdivided  into  five  groups  in  accordance 
with  the  classification  criteria.  The  five  groups  were: 

•  Navigation 

•  Flight  Instruments 

•  Flight  Data 

•  Autopilot  and  Flight  Controls 

•  Communications 


’\>mmon.il  ity  of  responses  was  used  to  establish  the  basis  for  a  first-order 
definition  of  the  word  digital.  Systems  considered  digital  by  one  airline 
or  manufacturer  and  not  considered  iiaital  by  another  were  evaluated  in 
the  light  of  their  applications  to  determine  why  they  were  considered  by 
industry  representatives  to  oe  unuuelv  iifferent  from  other  digital 
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systems.  This  process  of  cross-correlation  and  comparative  analysis  led 
to  the  development  of  categories  of  digital  systems  according  to  operational 
application  and  technical  design.  These  categories  provided  a  means  of 
directing  subsequent  data  collection. 

The  particular  application  of  a  digital  system  had  a  significant 
influence  on  the  extent  to  which  that  system  was  considered  relevant  to 
the  study.  Systems  approved  for  use  as  a  consequence  of  certification  of 
the  airframe  do  not  have  as  much  visibility  as  systems  that  are  certified 
independently  on  the  basis  of  unique  functional  capability.  Problems 
associated  with  a  particular  system  can  be  better  analyzed  when  abundant 
data  are  available  to  permit  tracing  the  history  and  resolution  of  the 
problems.  A  problem  was  considered  relevant  to  this  study  only  when  it 
was  identified  as  being  peculiar  to  the  use  of  digital  systems.  The  func¬ 
tion  of  the  system  in  which  a  problem  occurred  was  not  of  primary  concern 
unless  there  was  a  direct  relationship  between  the  function  and  the  prob¬ 
lem.  Emphasis  was  placed  on  identifying  those  systems  which  highlight  the 
performance  characteristics  of  digital  systems  rather  than  on  identifying 
every  digital  system  installed  on  an  aircraft. 


5.2  MTBR  AND  MTBF  TABLES 

The  following  subsections  provide  the  reliability  data  obtained  on 
both  air  carrier  and  general  aviation  digital  systems.  To  preserve  nar¬ 
rative  continuity.  Tables  5-3  through  5-10  are  presented  at  the  end  of  tlus 
chapter. 

5.2.1  Air  Carrier  Data 


Tables  5-3  through  5-10  present  the  reliability  data  collected  on  air 
carrier  avionics  in  the  form  of  MTBR  and  MTBF.  The  tables  are  organized 
by  major  system  categories,  as  described  in  the  following  sections.  The 
terms  used  in  the  tables  are  defined  as  follows: 

•  Unit  I.D.  Number  -  To  maintain  the  confidentiality  of  the  data, 
an  identity  number  was  assigned  to  each  model  investigated  rather 
than  use  the  manufacturer’s  model  number.  The  letter  prefixes 
represent  major  categories:  N  for  navigation  equipment,  I  for 
flight  instruments,  C  for  flight  controls,  and  M  for  miscellaneous 
equipments . 

•  Analog  or  Digital  -  An  A  or  D  is  shown  to  indicate  a  classification 
of  either  analog  or  digital  for  the  unit  listed. 

•  Operating  Hours  -  The  value  shown  for  operating  hours  is  the  total 
of  the  operating  hours  reported  from  all  sources.  For  the  MTBF 
tables,  the  operating  hours  reflect  only  those  sources  providing 
MTBF  data. 


•  Number  of  Removals  or  Failures  -  la  Tables  5-3,  5-5,  5-7,  and  5-9, 
the  total  number  of  removals  is  shown.  In  Tables  5-4,  5-6,  5-8, 
and  5-10,  the  total  number  of  reported  failures  is  shown. 

•  Lowest  and  Highest  Reported  Values  -  The  lowest  and  highest  reli¬ 
ability  values  reported  are  included  to  provide  an  indication  of 
the  variability  of  the  datr  and  to  reflect  extr  mes  reported  from 
the  various  sources. 

•  Average  Value  -  The  average  reliability  value  is  obtained  by  divid¬ 
ing  the  total  operating  hours  by  the  total  removals  or  total  failures. 

5. 2. 1.1  Navigation  Equipments 

More  than  30  models  were  investigated  as  possible  digital  units.  As 
shown  in  Table  5-3,  19  digital  models  were  identified  in  the  navigation 
category.  Some  of  the  models  that  were  found  to  be  analog  are  presented 
in  Table  5-3  for  comparison. 

As  shown  in  Table  5-4,  MTBF  data  were  reported  for  only  13  of  the  19 
identified  models  of  digital  navigation  systems. 

5.2. 1.2  Flight  Instruments 

Tables  5-5  and  5-6  address  the  flight  instrument  category.  As  shown 
in  thp  tables,  a  large  number  of  the  models  investigated  were  considered 
to  be  analog.  MTBR  data  were  received  on  only  16  of  L9  digital  models 
identified.  MTBF  data  were  received  on  8  digital  models. 

5. 2. 1.3  Flight  Controls 

Tables  5-7  and  5-8  address  the  flight  control  category.  Only  two 
models  were  identified  as  digital.  MTBR  data  were  reported  for  both  digi¬ 
tal  models,  and  MTBF  data  were  reported  for  only  one. 

5. 2. 1.4  Miscellaneous  Equipments 

Tables  5-9  and  5-10  present  the  data  collected  for  18  digital  models 
that  were  not  included  in  the  other  five  defined  categories.  Ml  and  M2 
are  representative  of  digital  communication  units.  M3  through  M18  are 
models  that  have  recently  been  developed;  they  include  flight  instruments 
and  electronic  engine  controls.  The  average  values  shown  for  M3  through 
M 1 9  are  based  on  estimates  or  preliminary  tests  rather  than  on  airline 
experience . 


3.2.2  deneral  Aviation  Data 

The  general  aviation  community  comprises  a  multitude  of  aircraft 
types,  ranging  in  complexity  from  gilders  and  single-engine  piston  air- 
;r  if t  to  air  transport  category  aircraft.  general  aviation  aircraft  are 
used  in  air  taxi,  ur  ;argo,  and  agricultural  operations,  and  in  business, 
research,  ind  personal  "lying.  The  equipment  flown  on  general  aviation 
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aircraft  cam  be  divided  into  three  major  categories:  (1)  equipment  built 
in  accordance  with  ARINC  characteristics,  (2)  equipment  designed  for  high- 
performance  general  aviation  aircraft,  and  (3)  equipment  designed  for  low- 
performance  general  aviation  aircraft. 

Discussions  with  representatives  of  avionics  manufacturers  indicate 
that  the  introduction  of  digital  avionics  into  the  general  aviation  market 
has  been  quite  limited.  MTBF  data  for  three  types  of  general  aviation 
digital  (microprocessor-based)  avionics  units  are  as  follows: 


Unit 

Calculated 
MTBF  (Hours) 

Demonstrated 
MTBF  (Hours) 

Field  MTBF* 
(Hours) 

Units  in 
Sample 

DME 

2,200 

1,700 

2,000 

2,000 

NAV 

1,370 

2,150 

1,740 

850 

COM 

1,670 

920 

1,550 

1,160 

The  MTBF  calculation  was  based  on  parts  count  and  design  data.  The  demon¬ 
strated  MTBF  was  determined  on  the  basis  of  stress  testing  of  a  limited 
sample  of  preproduction  units.  Analysis  of  warranty  failure-claim  data, 
assuming  an  average  utilization  rate  of  262  hours  per  year,  produced  the 
field  MTBF  values. 

The  warranty  failure  claim  data  and  the  average  utilization  rate  of 
262  hours  per  year  were  used  to  calculate  the  field  reliability  of 
nonmicroprocessor-based  avionics : 


Field 

MTBF 

Unit 

(Hours) 

DME 

600 

NAV 

500 

COM 

750 

No  calculated  or  demonstrated  MTBF  data  were  available  for  these  systems. 
The  number  of  units  in  the  nondigital  avionics  sample  w as  somewhat  larger 
than  the  number  in  the  digital  sample. 


‘During  investigation  of  the  reported  failures  of  digital  ’units,  it  was 
round  that  approximately  40  percent  of  the  reported  malfunctions  were 
mural  lation- r  e !  ate  i. 


Table  5-3.  MTBR  VALUES  FOR  NAVIGATION  EQUIPMENT 


tv 


I.D. 

Number 

Analog 

or 

Digital 

Operating 
Hours 
(Multiply 
by  1,000) 

Number 

of 

Removals 

Lowest 

Reported 

Value 

(Hours) 

Highest 

Reported 

Value 

(Hours) 

Average 

Value 

(Hours) 

VOR/ILS 

N1 

D 

609 

303 

723 

9,090 

2,009 

N2 

D 

237 

193 

1,225 

1,225 

1,225 

N3 

A 

544 

245 

1,372 

1,372 

2,222 

N4 

A 

1,046 

726 

1,064 

1,695 

1,372 

N5 

A 

263 

71 

3,703 

3,703 

3,703 

N6 

D 

3,297 

2,835 

885 

1,896 

1,163 

Omega 

N~ 

D 

743 

963 

348 

1,337 

771 

INS/NAV 

N8 

D 

18 

104 

160 

213 

178 

N9  . 

D 

5,873 

1,600 

725 

3,778 

3,670 

NlO 

D 

430 

549 

607 

1,626 

783 

Nil 

D 

465 

397 

864 

2,000 

1,171 

INS/CDU 

N12 

D 

198 

118 

1,613 

1,818 

1,678 

ATC  Transponders 

N13 

D 

304 

47 

1,887 

10,749 

6,476 

N 14 

D 

1,343 

481 

644 

10,383 

2,792 

N15 

D 

1,226 

393 

2,024 

4,166 

3,119 

N 16 

D 

352 

168 

1,557 

3,389 

2,095 

DME  Interrogator 

N17 

D 

819 

533 

1,010 

6,747 

1,536 

N18 

D 

1,832 

994 

1,003 

16,439 

1,84  3 

N1 9 

D 

938 

301 

2,083 

4,762 

3,116 

N20 

D 

141 

76 

1,683 

2,207 

1,865 

Radio  Altimeter 

N21 

0 

'49 

395 

1,492 

2,597 

1,897 

N22 

0 

1 ,  On  .* 

6 14 

1,117 

•i  •'l  —  "I 

1,735 

Conventional 

A1 timeter 

*•  '  7 

A 

3,846 

3 , 6  4 1  > 

3 , 646 

Table  5-4.  MTBF  VALUES  FOR  NAVIGATION  EQUIPMENT 
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Table  5-5.  MTBR  VALUES  FOR  FLIGHT  INSTRUMENTS 


I.D. 

Number 


Ground  Proximity 
Warning  System 


Analog 

or 

Digital 


Operating 
Hours 
(Multiply 
by  1,000) 


Number 

of 

Removals 


Lowest 

Reported 

Value 

(Hours) 


Air  Data  Computers 


Thrust  Rating 
Computer 


Stall  Warning 
Computer 


Mach  Airspeed 
Indicator 


2,500 

1,431 

816 

844 

744 

853 

1,219 

825 

961 

1,266 

1,250 

975 


Highest 

Reported 

Value 

(Hours) 


3,846 

8,849 

14,493 

20,334 


8,169 

2,081 

2,369 

3,226 

5,882 

2,678 

11,038 

825 

961 

1,266 

1,250 

975 


12,383 

9,803 


Average 

Value 

(Hours) 


1,787 

5,158 

2,564 

4,224 


12,383 

3,706 


5,555 

1,937 

25,000 

2,439 


Table  5-6.  MTBF  VALUES  FOR  FLIGHT  INSTRUMENTS 


I.D. 

Number 

Analog 

or 

Digital 

Operating 
Hours 
(Multiply 
by  1,000) 

Number 

of 

Failures 

Lowest 

Reported 

Value 

(Hours) 

Highest 

Reported 

Value 

(Hours) 

Average 

Value 

(Hours) 

Ground  Proximity 
Warning  System 

12 

D 

708 

34 

16,393 

76,923 

20,823 

14 

D 

490 

72 

3,734 

27,087 

6,805 

Air  Data  Computers 

15 

D 

246 

15 

6,060 

25,528 

16,400 

19 

A 

114 

53 

1,336 

5,882 

2,151 

110 

A 

309 

219 

1,411 

1,411 

1,411 

Ill 

A 

672 

186 

1,250 

13,556 

3,612 

112 

A 

62 

37 

1,672 

1,672 

1,672 

116 

A 

54 

34 

1,579 

1,5/9 

1,579 

Stall  Warning 

Computers 

119 

D 

237 

10 

24,765 

24,765 

24,765 

120 

A 

215 

32 

5,319 

21,276 

6,718 

Mach  Airspeed 

Indicator 

122 

A 

142 

63 

2,252 

2,293 

2,254 

Flight  Data 
Recorders 

126 

D 

183 

29 

6 , 066 

6,498 

6,310 

12? 

D 

141 

63 

2,222 

2,293 

2,238 

128 

D 

575 

186 

2,036 

3,875 

3,639 

Flight  Data 
Acquisition 

Unit 

130 

D 

80 

21 

3,802 

3,802 

3,802 
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bid  5-9.  MTBR  VALUES  FOR  MISCELLANEOUS  EQUIPMENTS 


NR  -  Value  not  reported. 


MTBF  VALUES  FOR  MISCELLANEOUS  EQUIPMENTS 


01 

CT> 

0) 

01 

<0 

3 

u 

r-H 

3 

ai 

ra 

0 

> 

< 

> 

s 

«  ^  %  2 

<u  v.  ^  g 

§  9  <o  o 

3  3T  >  5 

05 


r-H 

00 

ro 

in 

CD 

-u 

TJ 

ft  4) 

03 

0) 

a) 

£  3 

u 

x: 

H  , 

2  « 
8*> 
05 

3 

cn 

0 

■H 

X 

X 

o 

o 

o 

o 

X) 

o 

o 

o 

o 

o 

o 

00 

o 

o 

o 

o 

a> 

o 

o 

o 

o 

o 

o 

m 

o 

m 

LD 

rH 

rH 

ro 

rH 

rH 

<n 

o 

o 

o 

m 

r- 

rH 

oV 

ro 

oo' 

00 

in 

Lf) 

CO 

oo' 

H 

r** 

rH 

rH 

cr> 

r\i 

a> 

ro 

CN 

lO 

•» 

rH 

rH 

a 

m 

o 

rH 

05  05  05  05  05  05  05  05  05  05  05  05  05 


05Q5o:o:05  05  05  05  05  Q5a5o505 


0505050505050505050:050505 


o 

o 

o 

o 

o 

o 

CO 

■SJ1 

o 

«te 

CN 

ro 

o 

ro 

«  a  « 


a  a  os 


05  05  05 


CT  >,  — 

C  ■-I  O 

■H  »1  HO 
*J  M  -H  O 
HJ  3  +J  ' 

0  ^  ^ 
0X3 

i  s  >. 

o  '-  -a 


05  05  05  05  05  05  05  05  05  05  05  05  05 
ZZZZZZZZZZZZZ 


05  05  05 


aaaaaaaaaaaaa 


a  a  a 


.o  51  >  oo  s 
S  E  S  55  Z 


*NR  -  Volue  not  reported. 


CHAPTER  SIX 


DATA  ANALYSIS 


6.1  OVERVIEW 

This  chapter  presents  analyses  of  the  data  described  in  Chapter  Five. 
The  analyses  focus  on  identifying  the  relationships  between  unit  removal 
rates  and  the  following  variables  of  interest: 

•  System  category 

•  Failure  rate 

•  Design 

• •  Analog 
*  • •  Digital 

•  Application 

6.2  RELIABILITY  VS.  SYSTEM  CATEG^.-.Y 

Table  6-1  presents  calculated  MTBR  values  for  selected  groups  of 
digital  units.  The  units  are  grouped  by  functional  similarity  but  may 
not  be  functionally  interchangeable.  The  values  shown  are  based  on  the 
data  presented  in  Chapter  Five. 

Figure  6-1  graphically  summarizes  the  reliability  data  presented  in 
Table  6-1  on  various  types  of  air  carrier  digital  avionics  in  terus  of 
MTBR.  The  length  of  the  bars  shown  in  Figure  6-1  is  determined  by  the 
group  MTBR.  The  width  of  the  bars  is  proportional  to  the  operating  hours 
from  which  the  group  MTBR  was  obtained.  For  example,  the  MTBR  of  flight 
recorders  is  shown  as  nearly  1,800  hours;  the  width  of  the  bar  indicates 
that  a  total  of  3.5  million  hours  is  represented  in  the  sample.  Figure 
6-1  suggests  that  a  2,000  hour  MTBR  value  is  generally  achievable  by  a 
digital  desian. 

Comparison  of  the  group  MTBRs  with  the  individual  model  MTBRs  shown 
in  the  tables  of  Chapter  Five  shows  the  averaging  effect  of  grouping  data. 
The  Chapter  Five  tables  chow  MTBR  values  that  are  much  higher  and  much  lower 
than  2,000  hours.  The  wide  range  m  values  is  iue  to  the  ditferences  in 
desian  and  in  individual  maintenance  practices. 


Table  6-1 


RELIABILITY  OF  DIGITAL  EQUIPMENT  GROUPS 


Equipment 

Group 

Models  In 
Group 

Operating 
Hours 
(Multiply 
by  1,000) 

Number 

of 

Removals 

Lowest 
Individual 
MTBR  (Hours) 

Highest 

Individual 

MTBR  (Hours) 

Group 

Average 

MTBR 

(Hours) 

Navigation 

VOR/ILS 

Nl,  N2 ,  N6 

4,143 

3,331 

1,225 

2,009 

1,243 

INS 

N8»,  N9, 

N10,  Nil 

6,786 

2,650 

178 

3,670 

2,560 

INS/CDU 

N12 

198 

118 

1,613 

1,818 

1,673 

Transponders 

N13,  N14, 
N15,  N16 

3,225 

1,089 

2,095 

6,476 

2,961 

DME  Interrogator 

N17,  N18, 
N19,  N20 

3,730 

1,904 

1,536 

3,116 

1,945 

Radio  Altimeter 

N21,  N22 

1,818 

1,011 

1,735 

1,897 

1,798 

Flight  Instruments 

Ground  Proximity 

11,  IT, 
n,  i4 

8,022 

3,242 

1,787 

5,168 

2,474 

Air  Outa  Computers 

Digital 

15,  Xu 

648 

272 

1,6  77 

5,365 

2,382 

An  ilog 

18,  19, 

110,  Ill, 
113,  114, 
115 

2,919 

2,184 

961 

2,056 

1,336 

Thrust  Rating 

117,  118 

4,777 

2,974 

1,562 

1,992 

1,606 

Computers 

Flight  Recorders 

115,  126, 
121,  128 

3,54b 

1,985 

1,052 

4,125 

1,786 

Flight  Controls 

_ _ _ _ 

102 

n 

6,007 

o  ,007 

P  ,  30 7 

Gomm unicat ions 

Ml 

,3b  2 

847 

3  30 

1,018 

M2 

503 

39  3 

1,401 

•lib  aud  an  MTBR  or 

18,  with  104 

,  J00  operating  hours. 

’he  low  reliability  jould  indicate 

i  .  ;i»r  -tesiqn  compared  with  other  INS  units 

,  or  it  .ould  indicate  a  reporting  error. 

_ _ 

oL’MMARY  O  F  RE  I 


Note:  Width  of  bar  is 

proportional  to  number 
of. operating  hours  in 
millions. 


A  similar  presentation  based  on  MTBF  values  was  not  included,  because 
the  lack  of  sufficient  MTBF  data  prevents  valid  interpretation. 


6.3  REMOVALS  VS.  FAILURES 

The  confirmed-failure  ratio  is  obtained  by  dividing  the  MTBR  value  by 
the  MTBF  value.  The  ratio  is  often  used  by  airlines  and  manufacturers  as 
an  indication  of  whether  a  model  has  mechanical  or  operator  problems.  A 
low  ratio  may  indicate  either  that  removals  are  due  to  operator  error  or 
that  the  failure  condition  cannot  be  successfully  detected.  If  an  airline 
experiences  a  low  MTBR  and  a  low  confirmed-failure  ratio  (far  more  removals 
than  failures) ,  then  operating  procedures  are  checked  first.  In  the  case 
of  a  low  MTBR  and  a  high  confirmed-failure  ratio  (frequent  removals,  gen¬ 
erally  due  to  failures) ,  the  repair  records  are  reviewed  and  an  equipment 
modification  may  be  recommended. 

Table  6-2  lists  all  of  the  digital  units  investigated  for  which  data 
on  both  MTBR  and  MTBF  were  available.  The  identification  numbers  permit 
direct  correlation  with  the  data  tables  in  Chapter  Five. 


Table 

6-2.  CONFIRMED-FAILURE 

OF  DIGITAL  UNITS 

RATIO 

I.D. 

Number 

MTBR 

Hours 

•  MTBF 

Hours 

Ratio 

N 1 

2,009 

3,958 

0. 

51 

N2 

1,225 

2,111 

0. 

58 

NT 

771 

1,355 

0. 

57 

N 10 

783 

829 

0. 

94 

Nil 

2,792 

9,161 

0. 

30 

N15 

3,119 

4,350 

0. 

72 

Nib 

2,095 

3,826 

0. 

55 

Ml  7 

1,536 

7,122 

0. 

22 

N18 

1,84  3 

4,343 

0. 

42 

N20 

1,865 

3,525 

0. 

53 

N21 

1,897 

4 , 106 

0. 

46 

12 

5,158 

20,823 

9. 

25 

14 

4,224 

6,305 

6  2 

15 

5 , 365 

Lb , 400 

0 . 

33 

126 

4,125 

6,310 

,  > 

65 

127 

1,052 

2,127 

0  • 

49 

178 

3,091 

3,-19 

- ) . 

85 

Cl 

•i  ,  O'  >7 

11,34. 

5  3 

Ml 

1,018 

4,42  1 

' /  . 

2  i 

r  1  ; 


Mean 


The  geometric  mean  of  all  ratios  shown  in  Table  6-2  is  0.475.  This  is 
close  to  the  0.50  confirmed-failure  ratio  frequently  cited  in  industry, 
which  indicates  that  there  are,  on  the  average,  twice  as  many  removals  as 
confirmed  failures. 


6.4  ANALOG  VS.  DIGITAL 

Figures  6-2  and  6-3  compare  analog  reliability  with  digital  reliability 
in  terms  of  the  MTBR  and  MTBF  of  air  data  computers.  The  demonstrated 
reliability  of  the  digital  air  data  computer  identified  as  Model  15  is 
significantly  better  than  that  of  all  other  analog  and  digital  models 
represented.  The  MTBRs  of  the  other  two  digital  models  are  similar  to  the 
MTBRs  of  the  analog  models.  Although  the  data  do  not  provide  evidence  that 
all  digital  units  have  superior  reliability  in  comparison  with  analog  units 
that  perform  the  same  function,  the  reliability  of  Model  15  does  indicate 
that  significant  reliability  improvements  are  possible. 


6.5  APPLICATIONS  ANALYSIS 

The  various  models  of  Ground  Proximity  Warning  Systems  (GPWS)  are  all 
comparable  in  design.  Each  uses  analog  inputs  and  digital  processing,  and 
the  same  model  can  be  used  in  a  variety  of  aircraft. 

Figure  6-4  graphically* illustrates  the  data  of  Table  5-5  .for  four  GPWS 
models.  The  range  of  values  implies  that  functional  capability  is  only  one 
factor  affecting  the  MTBR  values.  If  the  MTBF  values  had  been  more  nearly 
equal,  it  might  have  been  concluded  that  units  of  similar  function  could  be 
expected  to  have  similar  MTBR  values. 

Figure  6-5  presents  the  MTBR  values  for  the  composite  of  the  four  GPWS 
models  by  airframe.  When  MTBR  values  of  individual  GPWS  models  are  compared, 
no  airframe  can  be  said  to  perform  best  consistently. 


6.6  SUMMARY  OF  ANALYSES 

The  analyses  presented  in  this  chapter  are  representative  examples. 

Air  data  computers  and  ground  proximity  warning  systems  were  used 
examples  because  sufficient  data  were  available  for  them.  Presentations 
based  on  other  digital  systems  would  have  shown  similar  results. 

The  available  data  on  the  reliability  of  air  carrier  avionics  indicate 
that  digital  systems  are  capable  of  performing  more  reliably  than  comparable 
analog  systems.  Average  MTBR  values  of  2,000  hours  and  MTBF  values  of 
4,0(10  hours  are  expected  for  most  iigital  systems. 


MTBF  (Hours) 


Figure  6-3.  MTBF  FOR  AIR  DATA  COMPUTERS 
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Operating  Hours 


Figure  o-4.  MTBR  FOR  GROUND  PROXIMITY  WARNING  SYSTEI S 
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CHAPTER  SEVEN 


DISCUSSION 


7 . 1  OVERVIEW 

Chapters  Five  and  Six  addressed  the  objective  data  collected  in  this 
study.  In  addition  to  the  objective  data,  valuable  subjective  information 
was  gathered  during  discussions  with  airline  and  manufacturer  representa¬ 
tives.  This  chapter  presents  the  subjective  information,  with  references 
to  objective  data  where  applicable. 


7.2  DIGITAL  EXPANSION 

Digital  equipments  have  been  introduced  to  the  airframes  through  both 
retrofit  and  initial  installations.  The ’airfYames  generally  called  "older" 
and  "narrow  body"  —  B-707,  B-727,  B-737,  DC-8,. and  DC-9  —  did  not  orig¬ 
inally  have  digital  equipment.  Digital  equipments  in  these  airframes  were 
retrofitted  with  modular  boxes  that  do  not  require  functional  integration 
with  the  airframe,  such  as  navigation  units,  ATC  transponders,  and  ground 
proximity  warning  systems.  In  some  cases,  major  retrofit  programs  modified 
airframes  by  incorporating  digital  systems.  The  DC-9-80  is  an  example  of 
an  extensive  digital  retrofit.  Wide-body  aircraft  such  as  the  DC-10,  B-747, 
L-1011,  and  A- 300  contain  some  integrated  digital  flight  controls  and  flight 
instruments  in  addition  to  the  previously  mentioned  modular  boxes. 

All  of  the  units  identified  in  the  equipment  lists  presented  in  Section 

5.2  are  currently  operational.  The  responsibility  for  implementation,  use, 
and  maintenance  of  those  systems  is  jointly  shared  by  manufacturers  and 
users.  Airframe  manufacturers  did  not  participate  in  this  activity  to  any 
significant  degree.  However,  the  introduction  of  integrated  cockpit  system 
architecture  as  an  integral  element  of  the  original  airframe  package  has 
shifted  a  significant  amount  of  integration  responsibility  to  the  airframe 
manufacturers.  In  their  new]y  emerging  role  as  system  integrators,  air¬ 
frame  manufacturers  are  concerned  with  the  performance  characteristics  of 
all  units  that  will  constitute  the  integrated  avionics  suites  to  be  incor¬ 
porated  in  new  aircraft  such  as  the  B-757  and  B-767. 

ruble  7-1  lists  the  planned  B-757  and  3-7f>7  equipments  that  include 
a  microprocessor.  The  list  shows  that  all  at  the  system  jategories  inves¬ 
tigated  m  this  study  will  be  digital  m  the  future. 


< 
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Table  7-1.  B-757/767  SYSTEMS  USING  MICROPROCESSOR-BASED 

DIGITAL  SYSTEMS 

Fuel  Quantity  System 

VOR 

VOR/DME 

ECS-Air 

Transponder 

Control  Panel 

Sypply  System 

Audio  Accessory 

Autopilot 

Unit 

Pack  Temperature 

Controller 

Electronic 

Yaw  Damper 

Flight 

Computer 

Cone  Temperature 

Instruments 

Controller 

Passenger 

Electronic 

Entertainment 

Cabin  Pressure 

Indication 

and  Service 

Controller 

and  Crew 

Alerting  System 

Digital  Flight 

Standby  Pack 

Data  Acquisition 

Controller 

ILS  Receiver 

Unit 

ECS  Flow  Sensor 

RMI 

Electronic  Clock 

Generator  Control 

ADF  Receiver 

Flight  Management 

Unit  Bus  Protection 

System 

Control  Unit 

DKE  Interrogator 

Windshield  Heat 

Radio  Altimeter 

Mach  Indicator 

Control 

Transceiver 

Vertical  Speed 

Overheat  Control 

VHF  Transceiver 

Indicator 

Svstem 

Altimeter  Control 

HF  Transceiver 

Panel 

Auxiliary  Power 

Unit  Control 

Weather  Radar 

Ground  Proximity 

System 

Computer 

Engine  Vibration 

Monitor 

Altitude  Alert 

Inertial  Reference 

Panel 

System 

Power  Management 

Computer 

Aural  Warning 

Pitch  Augmentation 

Panel 

Control  System 

Enqine  Electronic 

Control 

ILS  Control 

Thrust  Management 

Pane  1 

System 

Master  Warn  nut 

i  me  I 

Stall  Warning  Panel 

7.3  RELIABILITY  REPORTING  FORMATS 


As  mentioned  in  Chapter  Four,  the  reliability  reporting  formats  used 
by  airlines  and  manufacturers  are  designed  in  accordance  with  individual 
operational  and  management  practices.  There  are  variations  that  affect 
the  accessibility  and  traceability  of  records.  For  example,  it  is  a  com¬ 
mon  practice  to  assign  an  airline  part  number  in  addition  to  the  manufac¬ 
turer's  part  number.  If  the  airline  records  are  organized  by  airline  part 
number,  it  may  be  difficult  to  correlate  manufacturer  part  numbers  with 
airline  part  numbers.  Another  variation  is  in  the  reporting  periods. 
Almost  all  airlines  have  current-month  data.  However,  other  periods  may 
be  tracked,  such  as  each  month's  average,  three-month  average,  six-month 
average,  and  twelve-month  average.  Airlines  may  not  report  on  all  equip¬ 
ments.  Because  of  the  large  parts  inventory,  an  airline  may  monitor  only 
those  systems  whose  reliability  levels  trigger  a  threshold  for  concern. 
Thus  if  a  unit  is  maintaining  its  expected  level  of  performance,  it  will 
not  be  included  in  the  monthly  report. 


7.4  UNIT  RELIABILITY  AND  OPERATING  HOURS 

MTBR  and  MTBF  values  are  calculated  from  the  number  of  operating  hours 
between  removals  or  failures  of  an  individual  unit.  However,  the  determina¬ 
tion  of  operating  hours  varies  widely.  The  most  frequently  recorded  oper¬ 
ating  time  is  that  of  the  airframe,  which  is  usually  referred  to  as  "wheels 
up  to  wheels  down."  Since  the  avionics  units  are  often  operated  much  longer 
than  the  actual  flight  times,  a  multiplication  factor  is  introduced  to  com¬ 
pensate  for  the  difference.  The  factor  varies  among  airlines,  manufacturers, 
and  airports,  and  ranges  from  1.0  to  2.3.  That  large  a  variation  in  the  basic 
calculation  of  MTBR  and  MTBF  can  distort  any  comparisons  of  performance. 

Operating  hours  are  also  important  in  assessing  the  performance  of  a 
design.  New  designs  usually  have  low  MTBR  and  MTBF  values  when  first  put 
into  service.  As  experience  with  the  design  grows,  as  expressed  by  accumu¬ 
lated  operating  hours,  design  errors  are  found  and  corrected.  MTBR  and  MTBF 
values  then  increase  until  they  reach  a  mature,  or  consistent,  rate.  Design 
maturity  is  usually  reached  after  six  months  to  a  year  of  fleet  operation. 


7 . 5  MTBF  RECORDS 

Airlines  rely  more  on  MTBR  data  than  on  MTBF  data.  In  this  study, 
airlines  reported  MTBF  values  much  less  frequently  than  MTBR  values.  The 
major  reason  for  the  emphasis  on  removals  is  the  cost  to  the  airline  for 
removals  regardless  of  whether  any  failure  is  detected. 

The  fact  that  removed  units  may  be  sent  to  other  than  airline-owned 
repair  shops  makes  the  failure  records  difficult  to  trace.  Figure  7-1  illus¬ 
trates  the  typical  process  followed  for  unit  removal,  repair,  and  replacement. 


Avionics  manufacturers  prefer  tracking  MTBF  rather  than  MTBR.  This 
preference  is  due  to  the  perception  that  the  failure  rate  indicates  the 
quality  of  the  design  but  the  removal  rate  may  be  affected  by  training  and 
maintenance  practices. 


7.6  RELIABILITY  OF  MULTIPLE-UNIT  SYSTEMS 

The  reliability  of  a  system  composed  of  more  than  one  line  replaceable 
unit  (LRU)  must  be  related  to  the  probability  that  all  units  will  be  avail¬ 
able.  For  example,  a  navigation  unit  may  have  a  receiver  unit  and  a  separ¬ 
ate  control  display  unit  (CDU) .  A  failure  of  either  unit  removes  the  sys¬ 
tem  from  service. 


7.7  DIGITAL  PERFORMANCE  VS.  ANALOG  PERFORMANCE 

In  general,  the  digital  designs  are  not  one-to-one  conversions  from 
analog  designs.  When  a  previously  analog  function  is  provided  by  a  digital 
design,  additional  functions  and  features  are  often  included.  One  of  the 
most  important  of  these  features  is  built-in  test  (BIT) .  BIT  was  intended 
to  assist  in  the  detection  and  correction  of  failures  in  order  to  improve 
maintainability.  The  MTBR  and  MTBF  values  presented  in  Chapter  Five  indi¬ 
cate  that  digital  systems  can  offer  better  reliability  than  analog  systems. 
However,  the  ratio  of  MTBF  to  MTBR  for  digital  systems  approximates  the 
existing  ratio  for  analog  systems  —  an  average  of  two  removals  for  each 
confirmed  failure. 


7.8  FAILURE  MECHANISMS 

Damage  resulting  from  heat  and  power  transients  remain  a  major  cause 
of  failure  in  avionics.  Digital  designs  minimize  power  consumption,  there¬ 
by  reducing  the  level  of  heat  generated.  The  binary  switching  logic  in 
digital  designs  can  be,  however,  more  susceptible  to  the  effects  of  power 
transients. 


7.9  RELIABILITY  AND  CRITICALITY 

The  MTBR  and  MTBF  values  are  not  clearly  related  to  the  criticality 
of  service,  primarily  because  many  removals  and  failures  do  not  involve  a 
critical  function.  Reliability  values  are  associated  with  the  frequency 
rather  than  the  severity  of  failures.  For  example,  if  an  LED  display  had 
a  failed  segment,  it  would  be  removed  and  repaired.  However,  the  pilot 
may  have  been  able  to  use  the  display  in  spite  of  the  failure.  Another 
example  is  the  loss  of  secondary  functions.  Some  digital  units  may  include 
optional  accessories  or  features  that  are  not  critical.  Therefore,  a 
removal  and  repair  of  a  noncritical  function  could  affect  the  reported 
reliability  of  a  unit  without  affecting  the  unit's  reliability  for  critical 
functions. 


7.10  AREAS  OF  CONCERN 

Discussions  with  representatives  of  various  airlines,  the  Avionics 
Maintenance  Conference,  and  a  few  avionics  manufacturers  have  identified 
a  number  of  areas  of  concern  related  to  the  introduction  of  digital  systems. 

•  TSO  Compliance  -  The  complexity  of  software  in  future  digital  sys¬ 
tems  could  require  extensive  recertification  procedures  following 
software  modification. 

•  Loss  of  Integrity  -  The  use  of  integrity  monitoring  and  fault  flags 
should  be  sufficient  to  prevent  the  pilot  from  using  equipment  that 
is  out  of  tolerance. 

•  Fault  Propagation  -  A  fault  in  one  chip,  circuit,  unit,  or  subsystem 
can  be  manifested  by  a  fault  indication  in  another  chip,  circuit, 
unit,  or  subsystem.  This  phenomenon  frustrates  diagnosis  and  repair 
of  system  failure. 

•  Testability  -  Equipment  design  should  incorporate  sufficient  self¬ 
testing  capability  to  reduce  the  occurrence  of  unnecessary  removals. 

•  Component  Heating  -  Heat  has  always  been  a  cause  of  system  failure 
and  continues  to  deserve  attention  even  in  digital  designs. 

•  Electrical  Power  Spikes  -  Transients  in  power  circuits  occur  fre¬ 
quently  and  can  cause  severe  damage  to  avionics  systems. 

•  Electromagnetic  Interference  (EMI)  -  Digital  designs  are  not 
inherently  less  susceptible  to  EMI  than  analog  systems.  Although 
some  new  designs  incorporate  techniques  to  minimize  EMI,  EMI 
remains  a  problem. 
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CONCLUSIONS 


The  information  obtained  through  consultation  with  numerous  representa¬ 
tives  of  the  aviation  community  indicates  a  positive  attitude  toward  the 
capabilities  offered  by  digital  technology: 

•  MTBR  in  excess  of  2,000  hours 

•  Extensive  built-in-test  and  self-monitoring  capabilities 

•  Increased  functional  capability 

•  Flexibility  in  integration 

The  systems  evaluated  did  not  exhibit  problems  that  could  adversely 
affect  operational,  safety  to  any  significant  degree.  Avionics  manufacturers 
and  aircraft  operators  agree  in  general  that  the  economic  consequences  of 
avionics  unreliability  generate  market  forces  that  typically  exceed  the 
safety  requirements  of  regulations.  When  design  deficiencies  are  identified, 
timely  corrective  action  is  usually  taken  without  regulatory  prompting, 
because  such  action  is  in  the  best  interests  of  both  the  avionics  user  and 
the  manufacturer. 

The  reliability  data  obtained  for  this  study  were  of  the  same  nature 
as  the  data  reported  by  AMC  in  the  publication  PLANE  TALK.  Differences  in 
reporting  methods  (with  respect  to  both  systems  reported  on  and  reliability 
computation  methods  used)  prevented  a  more  comprehensive  analysis  beyond 
that  performed. 

If  the  data  base  on  unit  reliability  were  standardized,  trend  analysis 
could  be  applied  to  identify  progressively  worsening  conditions.  Expanding 
the  data  base  to  include  information  on  the  cause  of  failure  would  serve  to 
stimulate  design  improvements. 

Interviews  with  avionics  users  and  manufacturers  did  identify  some 
areas  of  concern  regarding  the  implementation,  use,  and  maintenance  of 
digital  systems: 

•  Effects  of  power  transients 

•  Effects  of  electrical  static  discharge 
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•  Requirements  for  software  configuration  control 

•  Requirements  for  dissimilar  redundancy 

•  Effects  of  fault  propagation 
• •  Detection 

• •  Isolation 
• •  Remedy 

No  attempt  has  been  made  in  this  report  to  develop  or  evaluate  possible 
means  of  alleviating  these  concerns. 

During  the  collection  and  analysis  of  the  data  presented  in  this 
report,  a  number  of  observations  were  made  regarding  the  availability  and 
interpretation  of  the  data: 

•  Lack  of  standard  definitions  of  "failure  condition"  and  "digital" 

•  Variations  in  computation  methods  and  reporting  formats  for  system 
reliability 

■  Lack  of  general-aviation  reliability  data 

•  Uncertainty  about  why  the  removals-to-failures  ratio  remains  as 
high  for  digital  systems  as  for  analog  systems 

•  Difficult  traceability  of  reliability  records 

Although  these  considerations  posed  problems  during  the  study,  close 
coordination  between  the  participants  made  it  possible  to  overcome  the 
problems  to  a  degree  that  was  adequate  for  the  study. 

It  should  be  noted  that  this  study  focused  on  only  one  aspect  of 
digital  technology:  unit  reliability.  The  continuing  evolution  of  digital 
technology  is  affecting  a  number  of  areas: 

•  Redundancy  techniques 

•  Functional  capabilities 

•  Systems  integration 

•  Maintenance  practices 

•  Monitoring  and  voting  techniques 

As  the  evolutionary  process  continues  to  improve  the  implementation, 
use,  and  maintainability  of  digital  systems,  operational  safety  may  be 
correspondingly  increased. 
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APPENDIX 


GLOSSARY 


AC 

ADF 

AMC 

ARINC 

ATC 

BIT 

CDCJ 

COM 

DME 

ECS 

EMI 

FAA 

FAR 

GPWS 

HF 

ILS 

INS 

LED 

LOC 

LRU 

MTBF 

MTBR 

MTBUR 

NAV 

RMI 

RTCA 

STC 

TSO 

VHF 

VOR 


Advisory  Circular 
Automatic  Direction  Finder 
Avionics  Maintenance  Conference 
Aeronautical  Radio,  Incorporated 
Air  Traffic  Control 
Built-In  Test 
Control/Display  Unit 
Communication 

Distance  Measuring  Equipment 
Electronic  Control  System 
Electromagnetic  Interference 
Federal  Aviation  Administration 
Federal  Air  Regulations  • 

Ground  Proximity  Warning  System 
High  Frequency 
Instrument  Landing' System 
Inertial  Navigation  System 
Light-Emitting  Diode 
Localizer 

Line  Replaceable  Unit 

Mean  Time  Between  Failures 

Mean  Time  Between  Removals 

Mean  Time  Between  Unscheduled  Removals 

Navigation 

Radio  Magnetic  Indicator 

Radio  Technical  Commission  for  Aeronautic 
Supplementary  Type  Certification 
Technical  Standard  Order 
Very  High  Frequency 
VHF  Omnidirectional  Range 


